DL::dlopen could open a library with tainted library name even if $SAFE > 0. This vulnerability affects Ruby versions 1.8, 1.9, 2.1, 2.2.
Upstream patch: https://github.com/ruby/ruby/commit/4600cf725a86ce31266153647ae5aa1197b1215b
Additional information and CVE assignment:
http://seclists.org/oss-sec/2015/q3/222
Originally, Common Vulnerabilities and Exposures assigned an identifier CVE-2011-1005 to the following vulnerability:
The safe-level feature in Ruby 1.8.6 through 1.8.6-420, 1.8.7 through 1.8.7-330, and 1.8.8dev allows context-dependent attackers to modify strings via the Exception#tos method, as demonstrated by changing an intended pathname.
Later it was reported: [1] http://www.openwall.com/lists/oss-security/2012/10/02/4
that the Ruby nameerrmesgtostr() method is vulnerable to the similar flaw.
Relevant upstream patch: [2] http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=37068
Originally, Common Vulnerabilities and Exposures assigned an identifier CVE-2011-1005 to the following vulnerability:
The safe-level feature in Ruby 1.8.6 through 1.8.6-420, 1.8.7 through 1.8.7-330, and 1.8.8dev allows context-dependent attackers to modify strings via the Exception#tos method, as demonstrated by changing an intended pathname.
Later it was reported: [1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=689075 [2] http://www.openwall.com/lists/oss-security/2012/10/02/4
that upstream ruby 1.9.1 and ruby 1.9.3 versions are also vulnerable to this flaw.
Relevant upstream patch: [3] http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=37068
Heap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1 before 2.1.0 preview2, and trunk before revision 43780 allows context-dependent attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a string that is converted to a floating point value, as demonstrated using (1) the tof method or (2) JSON.parse.
Ruby’s SSL client implements hostname identity check but it does not properly handle hostnames in the certificate that contain null bytes.
OpenSSL::SSL.verifycertificateidentity implements RFC2818 Server Identity check for Ruby’s SSL client but it does not properly handle hostnames in the subjectAltName X509 extension that contain null bytes.
Existing code in lib/openssl/ssl.rb uses OpenSSL::X509::Extension#value for extracting identity from subjectAltName. Extension#value depends OpenSSL function X509V3EXTprint() and for dNSName of subjectAltName it utilizes sprintf() that is known as null byte unsafe. As the result Extension#value returns ‘www.ruby-lang.org’ if the subjectAltName is ‘www.ruby-lang.org\0.example.com’ and OpenSSL::SSL.verifycertificateidentity wrongly identifies the certificate is for ‘www.ruby-lang.org’.
When a CA a SSL client trusts allows to issue the server certificate that has null byte in subjectAltName, remote attackers can obtain the certificate for ‘www.ruby-lang.org\0.example.com’ from the CA to spoof ‘www.ruby-lang.org’ and do man-in-the-middle between Ruby’s SSL client and SSL servers.
External References:
http://www.ruby-lang.org/en/news/2013/06/27/hostname-check-bypassing-vulnerability-in-openssl-client-cve-2013-4073/